The Standards require an internal audit function to assess itself, and most functions do it badly. A checklist is completed by the person who wrote the methodology; every item is marked “conforms”; the conclusion is filed; the audit committee hears that the function conforms to the Standards and has no idea what that was based on. Then the external assessor arrives, in year five, and finds what the self-assessment should have found in years one through four: workpapers without supervisory evidence, a charter that was never re-approved, performance metrics that were never reported, an independence declaration nobody signed. A self-assessment done well is the function auditing itself with the rigor it brings to everyone else, and it is cheaper than the alternative, which is being told by someone else.
This guide is the method: what the Standards require and how the self-assessment fits the quality program, timing and the external assessment cycle, the six components, who should do it and how to keep it honest, the rating scale and evidence, the report to the audit committee, a worked example from MidState Beverage, the companion tool on this site, and the failures that recur. It sits alongside the QAIP playbook (the whole quality program), the self-assessment template (the workbook) and the external quality assessment preparation guide (what comes at year five).
In this guide
- What the Standards require
- Timing and the external assessment cycle
- The six components
- Component 1: conformance mapping against the Standards
- Component 2: workpaper reselection
- Component 3: stakeholder surveys and interviews
- Component 4: performance metrics review
- Component 5: maturity scoring
- Component 6: gap analysis and action plan
- Who does it, and how to keep it honest
- The conformance rating scale and its evidence
- The report to the audit committee
- A worked example: MidState Beverage’s FY26 self-assessment
- The companion tool: the Self-Assessment Hub
- Failures that recur
- Questions about internal audit self-assessment
- Related guides
What the Standards require
The Global Internal Audit Standards (effective January 2025) make quality a shared responsibility. The board oversees the quality assurance and improvement program and receives the results of assessments (Standard 8.3); the chief audit executive develops and maintains the program, which must include internal assessments (Standard 12.1), measures the function’s performance (12.2) and oversees and improves engagement performance (12.3); and an external quality assessment is performed at least every five years (8.4), either as a full external assessment or as a self-assessment with independent external validation. Internal assessment has two parts: ongoing monitoring (the supervision, review and feedback built into every engagement) and periodic self-assessment, a step back from the day-to-day to ask whether the function conforms to the Standards, performs efficiently and effectively, and is seen by its stakeholders to add value. The Standards do not prescribe the periodic assessment’s method or frequency beyond “periodic,” but the structure of the Standards themselves (five domains, fifteen principles, fifty-two standards, each with requirements, considerations for implementation and examples of evidence of conformance) is the natural checklist, and the examples of evidence are what an assessor, internal or external, will look for. The Standards mapped guide gives the structure, the IPPF to GIAS mapping guide the changes from the prior framework, and the five domain guides (purpose, ethics, governing, managing, performing) the requirements in detail.
Timing and the external assessment cycle
Annually is the workable frequency: it aligns with the plan and the committee’s calendar, it produces a trend, and it keeps the external assessment from being a surprise. The cycle that works across five years: a full self-assessment in year one (the baseline), lighter annual updates in years two, three and four (re-rate the standards that changed or were partially conformant, re-run the workpaper reselection and the survey), a full self-assessment in year four that becomes the preparation for the external assessment in year five, and then the external assessment itself, which can take the self-assessment with independent validation route if the board prefers (an external assessor validates the function’s own conclusions rather than performing the whole assessment, cheaper but acceptable only if the self-assessment is rigorous enough to validate). New functions do a first self-assessment at twelve months, as the post-IPO guide describes, because the habits that are easy to fix at twelve months are expensive at four years. The self-assessment is also triggered by events: a new chief audit executive, a change to the Standards, a reorganization, a regulatory criticism of the function. The EQA preparation guide covers the year-five event; this guide produces the material it needs.
The six components
A self-assessment that produces findings has six parts, each with its own evidence: conformance mapping against every standard with evidence cited; reselection and review of a sample of completed engagements’ workpapers against the methodology; surveys and interviews of stakeholders (the audit committee, executives, auditees); a review of the function’s performance metrics against targets and trends; a maturity scoring against a capability model; and a gap analysis that turns the first five into an action plan. Each is described below. A function of any size can do all six in forty to eighty hours spread over six weeks; the large functions do more (regional samples, statistical surveys) and the one-person function does less (a shorter survey, three engagements reselected) but the components do not change, because an external assessor will perform all six and the self-assessment that skipped one will be told so.
Component 1: conformance mapping against the Standards
For each of the fifty-two standards, the mapping records the requirement in brief, the evidence the function has that it meets the requirement (named documents, records and practices, with locations), the gaps, and a rating. The discipline is evidence: “we have a charter” is not evidence that Standard 6.2 is met; “charter version 3.1, approved by the audit committee on 14 February 2026, containing the elements the standard requires (listed), reviewed annually per the charter’s own clause” is. The Standards’ examples of evidence of conformance are the prompt for what to look for, and the mapping is most useful where it is most uncomfortable: the governing standards (board approval of the charter, plan, budget and the chief audit executive’s appointment and evaluation; the private sessions; the functional reporting line in practice, not on the chart), the ethics standards (annual declarations of independence and conflicts, actually signed, actually reviewed), the managing standards (a risk-based plan with documented methodology, resource adequacy communicated to the board, coordination with other assurance providers, the quality program itself), and the performing standards (supervision evidenced in workpapers, documented engagement risk assessments, evidence standards, final communications containing the required elements, follow-up processes). The self-assessment template is a workbook with the fifty-two rows pre-built; the methodology manual guide covers the document the mapping most often cites.
| Domain | What the mapping tests | Evidence an assessor expects | Where functions usually fall short |
|---|---|---|---|
| I. Purpose | The function’s purpose statement and its reflection in the charter and plan | Charter; plan rationale; committee discussion | Purpose stated but not connected to the plan |
| II. Ethics and professionalism | Integrity, objectivity, competence, due care, confidentiality; independence declarations; conflicts; continuing development | Annual declarations; conflict log and handling; training records; CPE tracking | Declarations not collected; impairments not documented and disclosed |
| III. Governing | Board mandate; charter approval; independence and reporting lines; board oversight of plan, budget, resources, performance and quality; the chief audit executive’s qualifications and appointment | Charter and approvals; committee minutes showing each decision; private sessions; evaluation of the CAE | Decisions implied, not minuted; private sessions irregular; no board-level quality discussion |
| IV. Managing | Strategy; risk-based plan; resources communicated; methodology; coordination and reliance; communication with the board; performance measurement; quality program | Plan with risk assessment; resource statement to the board; methodology manual; assurance map; metrics reports; QAIP document and results | No internal audit strategy; metrics not reported; QAIP undocumented |
| V. Performing | Engagement planning (risk assessment, objectives, scope, work program); evidence; documentation; supervision; findings and conclusions; communication; follow-up | Workpapers meeting the methodology; supervisory review evidence; reports with required elements; tracker and validation records | Supervision not evidenced; engagement risk assessments missing; follow-up inconsistent |
Component 2: workpaper reselection
Conformance mapping tests what the function says it does; workpaper reselection tests what it did. Select a sample of completed engagements from the period (five to eight for a small function, more for a large one, covering different auditors, engagement types and ratings, and including at least one that produced a difficult report), and review each against the methodology with a fixed checklist: engagement risk assessment documented; objectives and scope approved and communicated; work program linked to objectives; evidence sufficient, reliable and relevant for each conclusion, with populations and samples documented; workpapers cross-referenced and complete; supervisory review evidenced with review notes and their clearance; findings supported by evidence and written to the function’s standard (the five Cs); report issued within the methodology’s timelines with the required elements; management responses and action plans recorded; follow-up scheduled. The reviewer should not have worked on the engagement, which in a small function means the chief audit executive reviews staff engagements and a peer or the committee chair’s nominee reviews the chief audit executive’s own. Results are recorded per engagement and aggregated (the share of engagements with each deficiency), because the aggregate is the finding: supervisory evidence missing in two of six workpapers is a conformance gap in Standard 12.3, not a comment on two files. The workpaper example and workpapers guides describe the standard the reselection applies.
Component 3: stakeholder surveys and interviews
The Standards’ expectation that the function adds value is testable only by asking the people it serves. Three groups, three instruments. The audit committee: a short structured interview with the chair (and a brief survey of members where the committee is larger), covering whether the function’s reporting is useful, whether the plan addresses the risks they care about, whether they trust the function’s independence and candor, and what they would change. Executives: a survey of eight to twelve questions on relevance, insight, professionalism and timeliness, plus interviews with two or three. Auditees: the post-engagement surveys the function should already be collecting (if it is not, start, and ask retrospectively for the period’s engagements), covering communication, understanding of the business, fairness, timeliness and the usefulness of findings. Scores are useful; comments are more useful, and the self-assessment reports both, including the uncomfortable ones. The instrument is kept stable year to year so the trend means something, and the KPIs and metrics guide includes the survey measures among the function’s standing metrics. One rule keeps surveys honest: the chief audit executive does not interview the committee chair about the chief audit executive; a peer or the function’s quality lead does, or the chair’s view is taken in writing.
Component 4: performance metrics review
Standard 12.2 expects the function to measure its performance against objectives, and the self-assessment reviews the year’s metrics as evidence of effectiveness and efficiency: plan completion against the approved plan (with changes approved); hours by category (direct engagement time, administration, training, co-source management); report cycle time from fieldwork end to issuance; issue closure and validation rates and aging; management acceptance of findings; repeat-finding rate; budget to actual; staff development (certifications, training hours, turnover); and the survey scores. The review asks whether the metrics exist, whether they were reported to the committee, whether they met targets, what the trends say, and whether the metric set itself is adequate (a function measuring only plan completion is measuring activity). Where metrics were not kept, reconstructing them for the year is part of the self-assessment and usually its first action item. The metrics guide gives the set and the targets most functions use.
Component 5: maturity scoring
Conformance is binary-ish (conforms or does not); maturity is directional, and the committee finds it easier to act on. The IIA’s Internal Audit Capability Model, with five levels from initial through infrastructure, integrated and managed to optimizing across six elements (services and role, people management, professional practices, performance management and accountability, organizational relationships and culture, governance structures), is the common frame; a function can also use a simpler five-level scale of its own design provided the levels are defined with observable criteria. The self-assessment scores each element with evidence, compares with the prior year and with the function’s target maturity (which the committee should set: not every function needs to be optimizing), and uses the gaps to prioritize the action plan. Maturity scoring is where self-assessments flatter themselves most, which is why each score should cite the evidence that would convince an outsider and why the committee chair’s view of the function’s maturity, taken in the interview, is recorded next to the function’s own.
| Level | What it looks like | Typical evidence |
|---|---|---|
| 1. Initial | Ad hoc; dependent on individuals; no sustainable practices | No methodology; plan by request; no metrics |
| 2. Infrastructure | Sustainable, repeatable practices; a charter, a plan, a methodology, a quality program in place | Approved documents; engagements follow a standard; basic metrics |
| 3. Integrated | Function aligned with the organization’s governance and risk management; coordination with other assurance providers; team competence managed; performance measured and reported | Assurance map; coordinated plan; competency framework; metrics to the committee; QAIP results reported |
| 4. Managed | Function integrates information across the organization to improve governance and risk management; strategic role; quantitative performance management; contributes to management development | Thematic reporting; advisory services on request; workforce planning; benchmarking; the function as a talent source |
| 5. Optimizing | Learning organization; continuous improvement; recognized as a key agent of change; professional practice shapes the organization’s | Innovation in method; external recognition; continuous feedback loops; influence on strategy |
Component 6: gap analysis and action plan
The first five components produce a list of gaps (standards partially or not conformant, workpaper deficiencies, stakeholder concerns, metrics missed or missing, maturity below target), and the gap analysis consolidates, prioritizes and assigns them. Priority follows consequence: anything that would produce a “does not conform” opinion from an external assessor comes first (usually governing and ethics gaps: board approvals, independence declarations, the quality program itself), then the performing gaps that affect engagement quality (supervision, evidence, risk assessments), then efficiency and maturity improvements. Each action has an owner (often the chief audit executive), a date, and the evidence that will show it is done, and the actions become part of the function’s own issue tracker so that next year’s self-assessment validates them the way the function validates everyone else’s actions (the closure standards apply to the function too). The committee approves the plan, because several actions (a budget for training or tooling, a charter amendment, a change to the reporting line) are the committee’s to grant.
Who does it, and how to keep it honest
Self-assessment’s weakness is in the name, and four practices offset it. Separate the roles: the person who maintains the methodology does not rate conformance with it alone; a quality lead, a senior auditor not involved in the engagements reviewed, or a rotating pair performs the mapping and reselection, with the chief audit executive as the challenger rather than the author. Rate against evidence, not intent: a standard is conformant only if the evidence exists and can be produced; a practice that is “about to be” documented is a gap. Record dissent: where the team disagrees on a rating, both views and the resolution are recorded, and the committee sees the contested items. Bring in an outsider cheaply: a peer chief audit executive from another organization, a professional body’s volunteer reviewer or an external quality assessor engaged for a day to challenge the self-assessment’s ratings (not to perform the assessment) converts self-assessment into something closer to independent validation at a fraction of the cost. And treat the self-assessment as an engagement: scoped, planned, evidenced, reviewed and reported, with workpapers an external assessor can read, because the external assessor will read them. The independence and objectivity guide covers the mindset; the function that audits itself leniently will audit others leniently too.
The conformance rating scale and its evidence
| Rating | Meaning | Evidence standard | Example |
|---|---|---|---|
| Generally conforms | The relevant structures, policies and procedures, and the processes by which they are applied, comply with the requirements of the standard in all material respects | Documents exist and are approved; practice is evidenced in the period’s work; minor variations do not affect outcomes | Charter current and approved; supervision evidenced in all reselected workpapers |
| Partially conforms | Deficiencies in practice that fall short of achieving some objectives of the standard, but do not preclude the function from performing its responsibilities acceptably | Documents exist but practice is inconsistent, or a required element is missing without impairing the function’s core work | Independence declarations collected for staff but not for the chief audit executive; metrics kept but not reported to the committee |
| Does not conform | Deficiencies significant enough to seriously impair or preclude the function from performing adequately in all or significant areas of its responsibilities | A required structure or practice is absent or ineffective at the level of the function | No quality program; the chief audit executive reports functionally to the chief financial officer with no board access; engagement conclusions without evidence |
| Not applicable | The standard does not apply to the function’s circumstances | Reason documented | External service provider standards for a function with no external providers |
The overall opinion follows the same three-level scale, with “generally conforms” available only when no standard is rated “does not conform” and the partial ratings do not cluster in a domain. A self-assessment that rates every standard “generally conforms” in its first year is almost always wrong and should be challenged by whoever reviews it.
The report to the audit committee
The report is short and structured for a committee that will spend fifteen minutes on it: the scope and method (the six components, who performed them, the independence safeguards); the overall conformance opinion with the count of standards at each rating and the list of partial and non-conformances with their causes; the workpaper reselection results in aggregate; the stakeholder survey headlines, including the critical comments; the metrics summary against targets; the maturity scores against target and prior year; the action plan with owners, dates and the committee’s decisions required; and a note on the external assessment timeline. Appendices hold the full mapping, the engagement-by-engagement reselection results and the survey detail. The chief audit executive presents it in the private session, under the presenting to the audit committee guide’s rules, and the committee minutes record the discussion and the approvals, which is itself evidence for Standard 8.3 next year. The annual agenda guide places the self-assessment in the committee’s calendar (the same meeting each year, usually the one after year end).
A worked example: MidState Beverage’s FY26 self-assessment
MidState Beverage is the mid-size beverage company used in the process examples on this site, with a six-person internal audit function, a charter rewritten in June 2026 and a first external assessment scheduled for FY28. The chief audit executive ran the function’s first full self-assessment in the fourth quarter of FY26 (about 60 hours), with a senior auditor performing the conformance mapping and workpaper reselection, the chief audit executive challenging the ratings, and a retired chief audit executive from a local professional chapter engaged for one day to review the ratings and interview the audit committee chair.
| Component | Result | Action |
|---|---|---|
| Conformance mapping (52 standards) | 41 generally conform; 9 partially conform; 2 do not conform; 0 not applicable. Non-conformances: Standard 12.1 (no documented quality program before this assessment) and Standard 8.3 (the board had never received a quality discussion). Partial: independence declarations collected informally; no internal audit strategy; resource adequacy never stated to the committee in writing; coordination with the external auditor undocumented; metrics kept but not reported; engagement risk assessments missing in older files | QAIP document drafted and approved by the committee; annual quality report added to the committee calendar; strategy and resource statement for FY27; declarations formalized; assurance map started |
| Workpaper reselection (6 of 14 engagements) | Supervisory review evidenced in 4 of 6; engagement risk assessment documented in 3 of 6 (all FY26 second-half engagements had one, reflecting the mid-year methodology update); evidence sufficient for conclusions in 6 of 6; report timelines met in 5 of 6; follow-up scheduled in 6 of 6 | Review sign-off made a system step; risk assessment template mandatory (already in place for new engagements) |
| Stakeholder surveys | Committee chair: reporting useful, wants more thematic insight and fewer engagement summaries; executives (9 of 11 responded): 4.1 of 5 on professionalism, 3.4 on business understanding, 3.6 on timeliness; auditees (11 engagements): 4.2 average, with two comments on report length | Quarterly report redesigned around themes; business knowledge plan (plant rotations for auditors); report template shortened |
| Metrics | Plan completion 86 percent (two deferrals approved); cycle time from fieldwork end to report 47 days against a 30-day target; issue validation rate 70 percent of due validations completed; repeat findings 2 of 38; metrics never shown to the committee | Metrics dashboard added to the quarterly report; cycle time target plan |
| Maturity (IA-CM) | Level 2 across four elements, level 3 in professional practices and organizational relationships; target set by the committee at level 3 across all elements by FY28 | Target recorded; actions mapped to elements |
| External review of the ratings | The reviewer agreed with 50 of 52 ratings, moving two from “generally” to “partially” (coordination with the external auditor; competence development planning), and judged the self-assessment rigorous enough to support a self-assessment with independent validation in FY28 | Ratings revised; FY28 approach decided |
Overall opinion: partially conforms, with a plan to reach generally conforms by the FY27 self-assessment. The committee’s response was the one a self-assessment hopes for: it approved the quality program and the budget for the chapter reviewer’s day each year, asked for the metrics dashboard quarterly, and noted that the function had told it something it did not know about itself. The EQA preparation guide describes what the FY28 validation will look like.
The companion tool: the Self-Assessment Hub
This site’s free Self-Assessment Hub runs in the browser with no account and no data leaving the device, and it walks a function through the conformance mapping with the standards pre-loaded, a rating and evidence field for each, and a summary by domain that can be exported for the committee report; the self-assessment template is the spreadsheet version for functions that prefer a workbook, and the QAIP playbook places the periodic self-assessment within the whole quality program. Used together with the workpaper reselection checklist and the survey instruments described above, they cover the six components for a function of any size.
Failures that recur
| Failure | How it shows | Fix |
|---|---|---|
| Author rates own methodology | Every standard conforms | Separate roles; external challenge of ratings |
| Conformance by intent | “We plan to document this” rated as conforming | Evidence that exists today, or a gap |
| Mapping without reselection | Policies conform; workpapers do not | Review real engagements against the methodology |
| Surveys skipped | Value to stakeholders asserted, never asked | Committee interview, executive survey, auditee surveys |
| Metrics absent | Standard 12.2 unmet; the function cannot describe its own performance | Reconstruct the year’s metrics; report quarterly |
| Maturity flattered | Level 4 claimed with level 2 evidence | Observable criteria; the chair’s view recorded alongside |
| Gaps without owners | Same gaps next year | Action plan in the function’s own tracker; validated next year |
| Committee never sees it | Standard 8.3 unmet; the EQA surprises the board | Report in the private session; minute the discussion |
| Done only in year four | Four years of unexamined drift | Annual, with lighter updates between full assessments |
| No workpapers for the self-assessment | External assessor cannot validate it | Treat it as an engagement |
Questions about internal audit self-assessment
What is an internal audit self-assessment?
The periodic internal assessment the Standards require within the quality assurance and improvement program: a structured review of the function’s conformance with the Standards, its engagement quality, its stakeholders’ views, its performance metrics and its maturity, producing a conformance opinion and an action plan reported to the board. It complements ongoing monitoring and prepares for the external assessment every five years.
How often should it be done?
Annually, with a full assessment in the first year and in the year before the external assessment, and lighter updates in between; also after a new chief audit executive, a change to the Standards, a reorganization or regulatory criticism. New functions assess at twelve months.
Who should perform it?
A quality lead or senior auditor not involved in the engagements reviewed, with the chief audit executive as challenger rather than author; the committee chair interviewed by someone other than the chief audit executive; and, where affordable, an outside peer or assessor engaged for a day to challenge the ratings.
What is “self-assessment with independent validation”?
One of the two forms of the external quality assessment required at least every five years: the function performs a rigorous self-assessment and an independent external assessor validates its conclusions, rather than performing the whole assessment. It is cheaper than a full external assessment and acceptable only if the self-assessment is thorough enough to validate.
What rating scale is used?
Generally conforms, partially conforms and does not conform, for each standard and overall, with not applicable where a standard does not apply; each rating is supported by named evidence, and the overall opinion can be “generally conforms” only when no standard is rated “does not conform.”
What goes to the audit committee?
A short report: scope and method with independence safeguards, the overall opinion and the list of partial and non-conformances, workpaper reselection results, survey headlines including critical comments, metrics against targets, maturity against target, the action plan with the committee’s decisions required, and the external assessment timeline, presented in the private session and minuted.
Related guides
- QAIP playbook — the whole quality program.
- QAIP self-assessment template — the workbook.
- Self-Assessment Hub — the free browser tool.
- Preparing for an external quality assessment — year five.
- The Global Internal Audit Standards, mapped — the structure.
- IPPF to GIAS mapping — what changed.
- GIAS Domain I: purpose — the first domain.
- GIAS Domain II: ethics and professionalism — declarations and competence.
- GIAS Domain III: governing — board decisions to evidence.
- GIAS Domain IV: managing — plan, resources, metrics, quality.
- GIAS Domain V: performing — engagement requirements.
- The internal audit methodology manual — the document the mapping cites.
- Internal audit KPIs and metrics — component 4.
- Internal audit workpapers — the reselection standard.
- Audit workpaper example — what good looks like.
- The five Cs of audit findings — findings quality in reselection.
- Independence and objectivity — keeping it honest.
- The internal audit charter — the governing evidence.
- The audit committee annual agenda — where the report sits.
- Presenting to the audit committee — the private session.
- Standing up internal audit after an IPO — the twelve-month first assessment.
- Evidence standards for issue closure — validating the function’s own actions.
Leave a Reply